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Mission 

Our  mission  is  to  provide  independent,  relevant,  and  timely 
oversight  of  the  Department  of  Defense  that:  supports  the 
warfighter;  promotes  accountability,  integrity,  and  efficiency; 
advises  the  Secretary  of  Defense  and  Congress;  and  informs 

the  public. 

Vision 

Ourvision  is  to  be  a  model  oversight  organization  in  the  federal 
government  by  leading  change,  speaking  truth,  and  promoting 
excellence;  a  diverse  organization,  working  together  as  one 
professional  team,  recognized  as  leaders  in  our  field. 


Fraud,  Waste  and  Abuse 

HOTLINE 

1.800.424.9098  •  www.dodig.mil/hotline 


For  more  information  about  the  whistleblower  protection,  please  see  the  inside  back  cover. 


Results  in  Brief 

The  Navy's  Management  of  Software  Licenses 
Needs  Improvement 


August  7,  2013 

Objective 

Our  objective  was  to  determine  whether  the 
Department  of  the  Navy  [DON]  effectively  managed 
software  licenses.  Specifically  we  determined 
whether  the  DON  included  appropriate  clauses 
in  software  license  contracts.  We  reviewed 
1  Enterprise  Licensing  Agreement  (ELA],  13  non- 
ELAs,  and  the  associated  End  User  License 
Agreements  (EULAs]  to  determine  if  the  contracts 
included  desirable  language  in  accordance  with 
the  DoD  Enterprise  Software  Initiative  approved 
software  licensing  training. 

Findings 

Overall,  the  DON  made  progress  toward 
the  mandated  use  of  DON  ELAs  by  issuing 
a  $700  million  ELA  for  Microsoft  software. 
However,  the  ELA  included  unacceptable 
language  in  2  of  the  11  best  practice  areas  we 
identified  in  software  licensing  training. 

In  addition,  the  DON  non-ELA  software  license 
contracts  reviewed,  valued  at  $8.1  million, 
included  unacceptable  language  for  contract 
clauses  in  7  of  the  11  areas  of  concern  listed  in 
the  software  licensing  training.  Furthermore, 
8  of  the  13  DON  contracting  officers  accepted 
EULAs  containing  unacceptable  language. 

This  occurred  because  no  established 
requirements  existed  to  guide  contracting 
personnel  in  making  a  determination  on 
whether  to  include  specific  clause  language  in 
software  license  contracts.  Furthermore,  11  of 
the  13  contracting  officers  did  not  receive  the 


Findings  Continued 

necessary  training  to  gain  the  specialized  knowledge  needed 
to  write  software  license  contracts  or  review  EULAs  properly. 
As  a  result,  the  DON  increased  the  risk  of  wasteful  spending, 
disruption  to  Government  operations,  and  vulnerability  to 
lawsuits,  claims,  and  penalties. 

Recommendations 

We  recommend  that  the  Assistant  Secretary  of  the  Navy  (Research, 
Development,  and  Acquisition]  (ASN[RDA])  require  all  DON 
contracting  personnel  involved  in  preparing  and  issuing  software 
license  contracts  to  take  specialized  training  on  using  appropriate 
language  in  software  acquisition  contracts. 

We  recommend  that  the  DON  Chief  Information  Officer  (CIO]: 

•  require  personnel  to  include  favorable  language  expressed 
in  warranty  and  embedded  third-party  software  sections  of 
the  software  licensing  training  when  preparing  ELAs  for  the 
remaining  software  on  DONs  proposed  list;  and 

•  issue  a  memo  identifying  the  types  of  training  available  for 
determining  the  appropriate  language  needed  to  include  and 
avoid  in  software  license  contracts. 

Management  Comments  and 
Our  Responses 

The  Executive  Director  for  the  Deputy  Assistant  Secretary 
of  the  Navy  for  Acquisition  and  Policy,  responding  for 
ASN(RDA],  comments  were  responsive  for  both  recommendations. 
The  DON  CIO  comments  were  responsive  to  two  of  three  and 
partially  responsive  to  one  of  three  of  the  recommendations.  We 
request  that  the  DON  CIO  provide  revised  comments  to  the  final  by 
September  9,  2013.  Please  see  the  Recommendations  Table  on  the 
back  of  this  page. 


Visit  us  on  the  web  ot  www.dodig.mil 
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Management 

Recommendations 
Requiring  Comment 

No  Additional 
Comments  Required 

Assistant  Secretary  of  the  Navy  (Research, 
Development,  and  Acquisition) 

l.a,  l.b 

Department  of  the  Navy 

Chief  Information  Officer 

2.c 

2. a,  2.b 

*Please  provide  comments  by  September  9,  2013. 
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INSPECTOR  GENERAL 

DEPARTMENT  OF  DEFENSE 

4800  MARK  CENTER  DRIVE 
ALEXANDRIA,  VIRGINIA 22350-1 500 


August  7,  2013 


MEMORANDUM  FOR  DEPARTMENT  OF  THE  NAVY  ASSISTANT  SECRETARY 


OF  THE  NAVY  (RESEARCH,  DEVELOPMENT,  AND 
ACQUISITION) 


DEPARTMENT  OF  THE  NAVY  CHIEF  INFORMATION 
OFFICER 


SUBJECT:  The  Navy’s  Management  of  Software  Licenses  Needs  Improvement 
(Report  No.  DODIG-2013-115) 

We  are  providing  this  report  for  your  review  and  comment.  The  Department  of  the  Navy 
made  progress  in  its  management  of  software  licensing  by  issuing  an  Enterprise  Licensing 
Agreement  for  Microsoft,  which  included  best  practice  language  for  the  acquisition 
of  software  licenses.  However,  the  13  non-Enterprise  Licensing  Agreement  software 
contracts  we  reviewed  did  not  include  desired  best  practice  language.  As  a  result,  the 
Department  of  the  Navy  increased  the  potential  of  wasteful  spending,  disruption  of 
Government  operations,  and  vulnerability  to  lawsuits,  claims,  and  penalties. 

We  considered  management  comments  on  a  draft  of  this  report  when  preparing  the  final 
report.  DoD  Directive  7650.3  requires  that  recommendations  be  resolved  promptly. 
The  Executive  Director,  Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition  and 
Procurement  comments  for  Recommendations  l.a  and  l.b,  responding  for  Assistant 
Secretary  of  the  Navy  (Research,  Development  and  Acquisition)  were  responsive  and  no 
further  comments  are  needed.  The  Department  of  the  Navy  Chief  Information  Officer  also 
provided  comments  that  were  responsive  on  Recommendations  2. a  and  2.b;  however, 
comments  on  Recommendation  2.c  were  only  partially  responsive.  Therefore,  we  request 
additional  comments  on  this  recommendation  by  September  9,  2013. 

If  possible,  send  a  portable  document  format  (.pdf)  file  containing  your  comments 
to  audros@dodig.mil.  Copies  of  your  comments  must  have  the  actual  signature  of  the 
authorizing  official  for  your  organization.  We  are  unable  to  accept  the  /Signed/  symbol 
in  place  of  the  actual  signature.  If  you  arrange  to  send  classified  comments  electronically, 
you  must  send  them  over  the  SECRET  Internet  Protocol  Router  Network  (SIPRNET). 

We  appreciate  the  courtesies  extended  to  the  staff.  Please  direct  questions  to  me 
at  (703)  604-8907  (DSN  664-8907).  If  you  desire,  we  will  provide  a  formal  briefing  on 
the  results. 


Alice  F.  Carey 

Assistant  Inspector  General 
Readiness,  Operations,  and  Support 
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Objective 

The  overall  objective  of  the  audit  was  to  determine  whether  the  Navy  was  effectively 
managing  software  licenses.  Specifically,  we  determined  whether  the  Navy  included 
appropriate  clauses  in  software  procurement  contracts.  We  initially  planned  to  review 
clauses  along  with  how  the  Navy  managed  its  inventory  of  software  licenses.  However, 
to  provide  more  timely  and  relevant  results  to  the  Department  of  the  Navy  (DON),  we 
narrowed  the  focus  to  only  appropriate  clauses  in  software  license  contracts. 

Background 

During  the  past  8  years,  vendors  have  made  claims  against  military  Services  because 
DoD  did  not  include  appropriate  language  in  software  contracts  or  because  DoD 
accepted  inappropriate  terms  in  the  vendor-prepared  End  User  License  Agreements 
(EULAs1).  According  to  the  Chief  Knowledge  Officer  within  the  U.S.  Army  Acquisition 
Support  Center,  when  software  contracts  are  not  written  carefully,  the  contract  and  EULA 
may  also  violate  the  Federal  Acquisition  Regulation  (FAR).  The  following  are  examples 
of  problems  encountered  by  DoD  because  of  the  lack  of  adequate  clauses  written  in  the 
contract  or  inappropriate  terms  accepted  in  a  EULA. 

•  In  an  instance  involving  Navy  lease-to-own  licenses  for  Oracle  applications, 
DLT  Solutions,  an  Oracle  reseller,  sued  the  Army2  because  the  initial  contract 
included  a  non-substitution  clause:  "The  Government  agrees  not  to  replace 
the  equipment  and/or  software  leased  under  this  order  with  functionally 
similar  equipment  and/or  software.”  The  claim,  including  appeals,  lasted 
from  2004  until  2010,  and  resulted  in  a  settlement  with  the  Government 
paying  DLT  Solutions  $1.2  million.  The  DoD  could  have  avoided  the  lawsuit 
had  it  been  aware  of  the  clause  in  the  contract  that  created  this  risk. 

•  According  to  U.S.  Army  Acquisition  Support  Center  personnel,  the  Army  had 
to  renegotiate  a  contract  to  avoid  spending  more  than  $40  million  to 
repurchase  80,000  user  licenses  at  a  cost  of  $500  per  license.  The  licenses 
were  for  troops  deploying  from  home  stations  that  already  had  licenses. 
However,  the  Army  did  not  initially  include  a  "Times  of  Conflict"  clause  that 
would  have  prevented  the  Army  from  having  to  purchase  new  licenses  for  the 
deployed  troops. 


1  A  EULA  is  the  comprehensive  license  agreement  between  the  Government  and  a  publisher  or  reseller  that  lists  the 
end  user's  rights.  Additional  names  for  a  EULA  include  but  are  not  limited  to  Purchaser  Use  Rights,  Software  License 
Agreement,  or  Software  User  Rights  Agreement. 

2  The  Army  issued  the  contract  for  $6.9  million  on  behalf  of  the  Navy. 
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•  In  2011,  a  vendor  contract  contained  language  in  the  EULA  that  violated 
FAR  52-212-4,  "Contract  Terms  and  Conditions-Commercial  Items." 
Specifically,  the  EULA  stated,  "Customer  rights  under  the  agreement  will 
terminate  immediately  without  notice  from  vendor  if  Customer  fails  to 
comply  with  any  provisions  of  the  Agreement."  This  violates  FAR  52-212-4, 
which  requires  a  contractor  to  continue  performance  in  the  event  of  a  dispute 
between  the  contractor  and  the  Government. 

Software  acquisition  contracts  that  do  not  include  appropriate  language  can  also  increase 
the  risk  of  compromising  sensitive  DoD  information.  For  example,  when  contracts  do 
not  include  language  that  limits  who  can  perform  an  audit  of  software  the  Government 
acquires,  the  contractor  could  have  an  audit  performed  by  a  third-party  auditor  who 
could  access  unauthorized  sensitive  Government  information. 

The  above  examples  underscore  the  need  for  contracting  officers  to  include  appropriate 
clause  language  in  software  acquisition  contracts  and  to  accept  only  EULAs  that  contain 
the  appropriate  language  that  will  protect  the  Government’s  best  interest. 

DoD  Software  License  Policy 

The  Defense  Federal  Acquisition  Regulation  Supplement  (DFARS)  227.7202,  "Commercial 
computer  software  and  commercial  computer  software  documentation,"  states  that 
commercial  computer  software  shall  be  acquired  under  the  licenses  customarily  provided 
to  the  public  unless  the  licenses  are  inconsistent  with  Federal  law  or  don’t  satisfy 
user  needs. 

DFARS  208.7402,  "General,"  also  applies  to  all  commercial  software.  The  DFARS  states  that 
departments  and  agencies  shall  fulfill  requirements  for  commercial  software  and  related 
services,  such  as  software  maintenance,  in  accordance  with  the  DoD  Enterprise  Software 
Initiative  (ESI).  This  initiative  includes  the  DoD  ESI  Software  Buyers  Checklist,  which 
provides  a  standardized  set  of  steps  to  follow  when  using  the  ESI’s  enterprise  software 
agreements.  The  Software  Buyers  Checklist  states  that  DoD  information  technology 
buyers  reduce  buying  cycle  time  and  risk  by  using  ESI  enterprise  software  agreements 
with  enhanced  terms  and  conditions  that  support  many  DoD  objectives  and  industry 
best  practices. 

The  DoD  ESI  is  an  official  DoD  initiative  sponsored  by  the  DoD  Chief  Information  Officer 
(CIO)  to  save  time  and  money  on  commercial  software,  Information  Technology  (IT) 
hardware,  and  services.  The  DoD  ESI’s  mission  is  to  lead  in  the  establishment  and 
management  of  enterprise  commercial  off-the-shelf  IT  agreements,  assets,  and  policies 
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for  the  purpose  of  lowering  total  cost  of  ownership  across  the  DoD,  Coast  Guard,  and 
intelligence  communities.  The  mission  extends  across  the  entire  commercial  IT  life  cycle, 
leveraging  the  DoD's  combined  buying  power  with  commercial  software  publishers, 
hardware  vendors,  and  service  providers. 

The  Computer  Hardware  Enterprise  Software  and  Solutions  (CHESS)  is  the  Army's 
designated  “primary  source"  for  commercial  IT.  CHESS  provides  a  no-fee,  flexible 
procurement  strategy  through  which  an  Army  user  may  procure  commercial  off-the-shelf 
IT  hardware,  software,  and  services  via  an  e-commerce  (IT  e-mart).  According  to  the 
Project  Director  of  Enterprise  Solutions  Division,  CHESS  is  also  the  Army's  representative 
to  the  DoD  ESI. 

In  2009,  the  Army  CHESS  staff  created  a  set  of  charts  and  briefings  specifically  dedicated 
to  software  issues  shared  with  other  DoD  agencies  and  presented  at  several  events  as  a 
portion  of  an  overall  CHESS  briefing.  The  software  licensing  training  developed  into  a 
stand-alone  training  in  2010.  The  DoD  ESI  also  began  working  with  a  support  contractor 
to  keep  the  charts  updated  and  provide  more  examples.  Currently,  the  CHESS  software 
licensing  training,  titled  “Software  that  Goes  Bump  in  the  Night  Brief,"  includes  best 
practices  for  software  licenses  acquisition  contracts.  The  same  training  is  also  provided 
through  ESI,  “Software  Licensing  Training:  Acquiring  Licenses  in  These  Changing  Times." 

The  training  presents  the  top  12  areas  of  concern  with  the  most  common  issues  identified 
in  EULAs  and  contracts.  Specifically,  it  gives  the  suggested  DoD  Software  Buyer  Checklist 
requirements  for  11  (excludes  maintenance)  of  the  areas  and  includes  examples  of 
acceptable  and  unacceptable  language  to  look  for  in  contracts  and  EULAs  for  each  area. 
The  11  specific  areas  are: 

•  warranty, 

•  transfer  rights, 

•  third-party  software,3 

•  audit  rights, 

•  click  wrap  licenses,4 

•  automatic  renewals, 


3  Software  associated  with  a  product  that  DoD  purchases  but  is  owned  by  a  vendor  other  than  the  vendor  DoD  purchased 
the  product  from. 

4  A  statement  or  notice  provided  to  software  user  from  the  vendor  that  states  that  by  clicking  accept,  the  user  agrees  to  all 
terms  of  the  vendor's  license  agreement. 
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•  termination  rights, 

•  governing  law, 

•  order  of  precedence, 

•  installation  restrictions,  and 

•  virtualization.5 

In  February  2012,  DON  issued  a  memorandum,  "Mandatory  Use  of  Department  of  the 
Navy  Enterprise  Licensing  Agreements,"  which  requires  all  DON  organizations  to  make 
software  licenses  purchases  using  DON  Enterprise  Licensing  Agreement  (ELA)6  contracts 
when  available.  The  memorandum  also  states  that  all  DON  organizations  and  programs 
can  achieve  maximum  cost  savings  by  using  enterprise  vehicles  as  the  means  of  procuring 
software  products. 

Review  of  Internal  Controls 

DoD  Instruction  5010.40,  "Managers’  Internal  Control  Program  (MICP)  Procedures," 
July  29,  2010,  requires  DoD  organizations  to  implement  a  comprehensive  system  of 
internal  controls  that  provide  reasonable  assurance  that  programs  are  operating  as 
intended  and  to  evaluate  the  effectiveness  of  the  controls.  We  identified  an  internal  control 
weakness  in  the  DON  software  license  contracting  process.  Specifically,  DON  did  not  have 
requirements  in  place  for  contracting  personnel  to  make  a  determination  on  whether  to 
include  specific  clause  language  in  software  license  contracts.  Further,  DON  contracting 
personnel  did  not  have  the  necessary  training  to  gain  the  specialized  knowledge  to  write 
software  license  contracts  properly.  We  will  provide  a  copy  of  the  report  to  the  senior 
official(s)  responsible  for  internal  controls  in  the  DON. 


5  Creation  of  a  virtual  (rather  than  an  actual)  version  of  something,  such  as  an  operating  system  or  server. 

6  An  ELA  is  a  contract  document  used  to  purchase  software  and  contains  the  names  and  types  of  software  as  well  as  the 
amount  the  purchaser  is  allowed  to  spend  toward  the  software  for  a  given  period  of  time. 
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Finding 

Improvement  Needed  in  the  Software  Licensing 
Acquisition  Process 

In  May  2012,  the  DON  made  progress  toward  the  mandated  use  of  DON  ELAs  by  issuing 
a  $700  million  ELA  for  Microsoft  software.  However,  the  ELA  included  unacceptable 
language  for  embedded  third-party  software  and  warranty,  which  are  2  of  the  11  areas  of 
concern  with  best  practices  identified  in  the  DoD  ESI  approved  software  licensing  training. 
In  addition,  the  13  DON  non-ELA  software  license  contracts,  valued  at  $8.1  million, 
included  unacceptable  language  for  contract  clauses  in  7  of  the  11  areas  of  concern  listed 
in  the  software  licensing  training.  Furthermore,  8  of  the  13  DON  contracting  officers 
accepted  EULAs  that  contained  unacceptable  language  such  as  inadequate  warranty  and 
transfer  rights  that  did  not  benefit  the  DoD. 

This  occurred  because  the  DON  had  no  established  requirements  for  contracting 
personnel  to  make  a  determination  on  whether  to  include  specific  clause  language  in 
software  license  contracts.  In  addition,  11  of  13  contracting  officers  did  not  receive  the 
necessary  training  to  gain  the  specialized  knowledge  needed  to  write  software  license 
contracts  or  review  EULAs  properly.  As  a  result,  the  DON  increased  risk  of  wasteful 
spending,  disruption  to  Government  operations,  and  vulnerability  to  lawsuits,  claims, 
and  penalties. 


Microsoft  Enterprise  Licensing  Agreement  Awarded 
to  Reduce  Costs 

DON  showed  progress  in  managing  software  licenses  by  awarding  a  Microsoft  ELA7  in 
May  2012  in  accordance  with  the  DON  February  2012  memorandum.  The  ELA  allows 
the  DON  as  well  as  General  Services  Administration  or  other  organizations  ordering  on 
behalf  of  DON  to  place  orders  for  Microsoft  software  licenses.  In  addition,  according  to 
the  memorandum,  using  the  ELA  to  obtain  software  will  help  the  DON  achieve  maximum 
cost  savings.  The  Microsoft  ELA  is  the  only  ELA  the  DON  has  issued  to  date.  According 
to  DON  CIO  personnel,  they  are  adapting  the  use  of  ELA  contracts  for  all  software 
license  procurements,  as  mandated  by  the  February  2012  memorandum,  but  Microsoft 
was  implemented  first  because  of  its  wide  use  throughout  the  Navy.  A  proposed  list 


7  The  Microsoft  ELA  is  a  blanket  purchase  agreement  between  DON  and  a  contractor  to  purchase  Microsoft  products. 
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of  14  additional  DON  ELA  opportunities  in  the  February  2012  memorandum  included 
Cisco,  Oracle,  Adobe,  Symantec,  Xerox,  and  VMware,  among  others,  for  future 
consideration.  The  memorandum  also  stated  that  the  DON  CIO  would  post  the  projected 
award  dates  of  the  potential  opportunities  to  an  access-controlled  website  linked  to  the 
CIO  website  once  dates  were  determined. 

According  to  DON  CIO  personnel,  they  have  determined  projected  dates  for  11  of 
the  remaining  14  DON  ELA  opportunities  listed  in  the  memorandum  and  provided  a 
timeline  that  reflected  six  opportunities  planned  for  this  fiscal  year  and  five  in  FY  2014. 
Furthermore,  they  stated  that  they  will  not  pursue  three  of  the  opportunities  because  they 
determined  that  the  opportunities  were  considered  low  volume  based  on  initial  review. 

Microsoft  Enterprise  Licensing  Agreement  Included 
Unacceptable  Language 

The  ELA  for  Microsoft  software  and  associated  product  use  rights  document  (EULA 
equivalent)  included  unacceptable  language  in  2  of  11  areas  identified  as  areas  of 
concern.  Specifically,  the  product  use  rights  document  associated  with  the  ELA  included 
unacceptable  language  in  the  areas  of  embedded  third-party  software  and  warranty. 

The  contracting  officer  that  prepared  the  Microsoft  ELA  did  not  consider  the  risk  when 
he  excluded  language  that  would  be  in  the  best  interest  of  the  DoD  in  terms  of  third-party 
embedded  software.  Specifically,  the  Microsoft  Federal  Product  Use  Rights  document, 
dated  April  2012,  attached  to  the  Microsoft  ELA  stated,  with  regard  to  Windows  embedded 
products,  "Despite  anything  to  the  contrary  in  the  Included  Microsoft  Software  Programs 
section  in  the  General  License  Terms,  all  Windows  embedded  products  are  governed 
by  their  own  license  terms.”  In  other  words,  the  DON  must  not  only  follow  Microsoft’s 
licensing  terms  but  also  must  follow  the  licensing  terms  of  the  third-party  vendors 
whose  products  are  embedded  in  Windows. 

Although  the  above  statement  informed  the  DON  they  must  follow  the  licensing  terms 
of  third-party  vendors,  the  Products  Use  Rights  did  not  list  the  third  parties  or  their 
licensing  terms.  The  DoD  position  in  the  DoD  ESI  approved  software  licensing  training 
is  that  DoD  must  be  aware  of  the  third-party  software  requirements  to  weigh  the  risk 
to  software  procurement.  The  software  licensing  training  also  provides  examples  of 
desired  language  for  this  situation,  which  would  require  the  publisher  of  the  software 
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(in  this  case  Microsoft)  to  ensure  they  obtained  all  necessary  third-party  licenses.  In 
addition,  the  training  suggests  language  stating  that  the  publisher  complies  with  the 
third-party  licenses  and  ensures  that  DoD’s  use  of  the  product  will  not  be  in  conflict  with 
the  third-party  license.  In  this  instance  the  vendor  should  have  included  language  that 
protected  the  DoD,  as  intended  by  the  examples  provided  in  the  software  licensing  training. 
However,  according  to  the  contracting  officer,  the  existence  of  embedded  software  was 
not  recognized  as  a  risk  during  negotiations  and  therefore  they  did  not  weigh  the  risk  of 
third-party  embedded  software  prior  to  awarding  the  DON  Microsoft  ELA. 

In  addition,  the  contracting  officer  accepted  warranty  disclaimer  language  in  the 
product  use  rights  document  that  was  not  in  the  best  interest  of  DON  in  terms  of 
protecting  against  potential  defects  in  the  software.  Specifically,  the  product  use  rights 
document  included,  in  addition  to  the  limited  warranty,  a  disclaimer  of  warranties  for 
merchantability,8  fitness  for  a  particular  purpose,  and  satisfactory  quality.  The  software 
licensing  training  specifically  lists  disclaimers  of  these  three  warranties  in  an  example  of 
unacceptable  language  when  reviewing  a  disclaimer  of  warranties  clause.  However,  the 
Microsoft  ELA  includes  FAR  clause  52.212-4,  which  states  that  the  contractor  warrants 
and  implies  the  items  delivered  are  merchantable  and  fit  for  use.  Additionally,  the  general 
terms  and  conditions  in  the  contract  state  that  the  provisions  of  FAR  52.212-4  and  the 
ELA  take  precedence  over  any  terms  of  the  product  use  rights  document.  Therefore, 
the  FAR  52.212-4  warranty  provisions  for  merchantability  and  fitness  for  a  particular 
purpose  would  prevail.  Neither  the  provisions  of  FAR  52.212-4  nor  the  ELA  specifically 
names  satisfactory  quality  or  items  such  as  "accuracy,"  which  is  also  included  in  the 
product  use  rights  disclaimer.  The  absence  of  these  warranties  imposes  the  risk  on  the 
DON  that  it  will  have  limited  recourse  if  the  product  fails  in  these  disclaimed  areas. 

According  to  the  contracting  officer,  the  warranty  section  of  the  contract  was  one  of 
the  terms  and  conditions  incorporated  from  the  DoD  ESI  Microsoft  blanket  purchase 
agreement;  DON  was  not  able  to  negotiate  terms  that  differed  from  this  agreement. 
DON  CIO  should  determine  whether  it  is  in  the  Government’s  interest  to  modify  the 
Microsoft  enterprise  license  agreement  regarding  warranty  and  embedded  third-party 
software.  In  addition,  the  DON  CIO  should  require  personnel  to  include  favorable 
warranty  and  embedded  third-party  language  when  preparing  ELAs  for  the  remaining 
software  opportunities  on  the  list,  such  as  Cisco,  Oracle,  and  Adobe,  or  document  how 
and  why  they  determined  and  accepted  the  risk  of  not  including  the  language. 


8  To  disclaim  merchantability  means  the  vendor  does  not  guarantee  and  will  deny  any  claim  for  a  software  product  that  is 
not  marketable  or  of  commercially  acceptable  quality. 
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Non-Enterprise  Licensing  Agreement  Contracts 
Did  Not  Include  Best  Practice  Clauses 

The  DON  could  improve  the  13  non-ELA  contracts  reviewed,  valued  at  $8.1  million,  by 
including  language  provided  in  the  software  licensing  training.  Specifically,  the  audit  team 
reviewed  13  non-ELA  software  license  contracts9  issued  by  12  different  DON  contracting 
offices  and  determined  that  none  contained  all  the  best  practice  language  to  ensure  the 
DON’s  best  interest  was  protected. 

The  DON  non-ELA  software  license  contracts  include 
unacceptable  language  for  contract  clauses  in  7  of  the 
11  areas  of  concern  listed  in  the  software  licensing 
training.  For  example,  of  the  13  contracts,  none  contained 
acceptable  language  for  warranty,  transfer  rights,  or 
termination  rights.  One  contract  stated  that  the  vendor  is 
to  provide  a  minimum  90-day  warranty  on  all  performed 
work/upgrades.  However,  the  DoD  position  referenced  in  the 
software  licensing  training  recommends  a  warranty  that  states 

the  software  shall  meet  specifications  and  requirements  for  1  year  from  the  first  day  the 
product  is  used.  In  addition,  for  transfer  rights,  the  software  licensing  training  refers  to 
the  DoD  Buyer  Checklist,  which  states  the  DoD  buyer  is  to  add  language  in  the  terms  and 
conditions  of  an  order  allowing  for  transfer  of  licenses  within  an  affiliate  of  DoD  or,  at  a 
minimum,  within  the  component  (in  this  instance,  DON).  However,  12  of  the  13  contracts 
were  silent  to  transfer  rights.  The  one  contract  that  included  transfer  rights  stated  that 
the  DON  component  that  received  the  software  recognized  that  the  supplied  software 
was  for  the  sole  use  of  that  facility.  By  both  agreeing  to  terms  that  restricted  sole  use  to 
one  facility  and  without  any  other  terms  on  transfer  rights,  the  contracts  did  not  allow  for 
transfer  within  DoD  or  DON  as  the  checklist  suggests. 

In  addition,  at  least  one  contract  contained  unacceptable  language  in  the  areas  of 
audit  rights,  click  wrap  licenses,  order  of  precedence,  and  installation  restrictions.  For 
example,  one  contract  was  silent  to  both  audit  rights  and  click  wrap  licenses.  If  a  contract 
were  silent  on  these  two  areas,  we  considered  it  acceptable  as  long  as  the  EULA  was 
also  silent,  because  this  would  mean  there  is  also  no  unacceptable  language  present. 
However,  the  EULA  associated  with  the  contract  included  unacceptable  language  in  both 
areas.  For  example,  the  EULA  contained  a  statement  that  it  is  a  legal  agreement  between 


Of  the 

13  contracts, 
none  contained 
acceptable  language 
for  warranty, 
transfer  rights,  or 
termination 
rights. 


9  The  audit  team  reviewed  two  contracts  that  were  prepared  by  different  contracting  officers  but  issued  from  the  same 
contracting  office,  to  verify  a  consistent  pattern  of  terms. 
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an  individual  or  corporation  and  the  vendor;  by  installing,  copying,  downloading,  or 
accessing  the  product,  the  individual  or  corporation  agrees  to  the  terms  of  the  EULA.  This 
language  is  labeled  as  click  wrap  and  considered  unacceptable  in  the  DoD  ESI  approved 
software  licensing  training.  The  complete  results  of  the  non-ELA  reviews  are  shown  in 
the  table  below 


DON  Results  of  Best  Practice  Language  i 

n  13  Non-ELA  Contracts  Reviewed 

11  Key  Clauses 

Unacceptable 

Language* 

Acceptable 

Language** 

Desired 

Language*** 

Warranty 

13 

0 

0 

Transfer  Rights 

13 

0 

0 

Third  Party  Software 

0 

13 

0 

Audit  Rights 

1 

12 

0 

Click  Wrap  Licenses 

1 

12 

0 

Automatic  Renewals 

0 

13 

0 

Termination  Rights 

13 

0 

0 

Governing  Law 

0 

12 

1 

Order  of  Precedence 

3 

10 

0 

Installation  Restrictions 

1 

12 

0 

Virtualization 

0 

13 

0 

*  Contract  contained  undesirable  language  or  was  silent  (adds  risk  for  certain  clauses)  on  key 
clauses  necessary  to  meet  the  intent  of  the  best  practices. 


**  Contract  did  not  contain  the  desired  language;  however,  the  contract  was  either  silent 
(acceptable  for  certain  clauses)  or  contained  comparable  language,  that  was  deemed 
acceptable  to  meet  the  intent  of  the  best  practices  training. 

***  Contract  contained  desired  language  from  the  best  practices  training 

As  shown  in  the  table,  the  majority  of  the  non-ELA  contracts  contained  language  we 
determined  was  acceptable  for  8  of  the  11  key  areas.  However,  most  of  these  areas  we 
determined  were  acceptable  because  the  contract  was  silent  on  the  area  and  therefore  did 
not  contain  unacceptable  language.  Silence  in  these  areas  may  help  limit  possible  claims 
or  penalties  the  DoD  could  otherwise  incur  when  certain  language  is  found  in  contracts. 
However,  silence  does  not  help  ensure  the  best  interest  of  the  DoD  is  met  as  intended 
by  the  desired  language  included  in  the  DoD  ESI  approved  software  licensing  training. 
Although  we  identified  issues  in  the  non-ELA  contracts,  we  determined  it  would  not  be 
reasonable  or  efficient  to  reopen  negotiations  for  these  because  of  the  dollar  value  of  the 
contracts  versus  the  potential  cost  to  renegotiate.  In  addition,  the  DON's  movement  to 
ELAs  discussed  in  the  Microsoft  section  should  eventually  eliminate  or  minimize  the  need 
for  these  small  contracts. 
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End  User  License  Agreement  Language 
Did  Not  Benefit  DoD 

None  of  the  eight  EULAs  reviewed  contained  appropriate  language  in  all  the  best  practice 
areas.  Our  review  of  the  EULAs  associated  with  the  non-ELA  contracts  showed  that  all 
eight  DON  contracting  officers  accepted  EULAs  that  contained  unacceptable  language 
that  did  not  benefit  the  DoD.  Specifically,  we  reviewed  EULAs  for  8  of  the  13  contracts 
reviewed.  For  the  remaining  five  contracts: 


•  one  contracting  officer  stated  that  the  vendor  did  not  provide  a  EULA  or  any 
other  Software  Agreement  with  the  contract  but  provided  an  agreement  to 
the  end  users  with  the  software; 

•  one  contracting  officer  stated  the  contractor  provided  the  end  user  with  terms 
and  conditions  after  award  of  the  contract  but  no  agreement  was  received, 
reviewed,  or  approved  by  the  contracting  office; 

•  one  contracting  officer  was  unsure  whether  a  EULA  existed  and  referred  to 
the  original  acceptor  of  the  purchase  requisition,  who  stated  that  he  had  no 
written  agreements  with  the  vendor;  and 

•  two  contracting  officers  stated  that  the  vendor  did  not  provide  a  EULA  or 
equivalent  document  outlining  the  comprehensive  agreement  between  the 
Government  and  publisher  or  reseller. 


Acceptable  language  for  warranty,  transfer  rights,  or  termination  rights,  was  not  found 
in  any  of  the  eight  EULAs  reviewed.  One  EULA,  for  example,  stated  that  the  licensor 
warrants  that  the  licensed  program  will  conform  to  the  published  specifications  for 

180  days  from  the  date  of  shipment.  This  is  far  less  than  the  best 
practice  of  1  year  from  first  use  of  the  product,  as  stated  in 
the  software  licensing  training.  The  remaining  EULAs 
either  contained  unacceptable  language  or  were  silent 
on  these  three  areas.  Because  it  is  in  the  best  interest  of 
DoD  to  have  a  warranty  on  software  for  at  least  1  year,  to 
be  able  to  transfer  a  license  within  DoD,  and  to  include 
proper  termination  rights,  we  considered  it  unacceptable 
for  EULAs  to  be  silent  in  these  areas. 


In  addition,  one  contracting  officer  accepted  a  EULA  that  included  unacceptable  language 
for  audit  rights.  Specifically,  the  EULA  stated  that  during  business  hours,  the  vendor  may 
inspect  the  facility  and  records  to  verify  compliance  with  the  EULA  for  use  of  the  software 
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product  purchased,  throughout  the  term  of  service  and  for  1  year  after.  If  noncompliance 
was  found,  the  DON  organization  was  required  to  pay  any  underpayment  amount  within 
15  days  of  receipt  of  a  letter.  In  addition,  if  underpayment  was  more  than  5  percent  of 
the  amount  DON  should  have  paid  based  on  the  amount  of  software  DON  used,  the  DON 
organization  was  required  to  reimburse  the  vendor  for  the  amount  incurred  to  conduct 
their  audit.  The  DoD  position  in  the  software  training  is  that  the  Government  should 
perform  self-audits  and  report  the  results  to  the  contractor  no  more  than  once  per  year. 

All  the  EULAs  reviewed  were  silent  in  the  areas  of  third-party  software,  click  wrap 
licenses,  order  of  precedence,  and  virtualization.  Because  the  software  licensing  training 
provides  examples  of  language  contracting  officers  should  recognize  and  avoid  on  these 
topics,  we  considered  the  EULAs  silence  on  these  topics  to  be  acceptable. 

We  found  only  two  examples  of  desired  language  from  the  software  licensing  training 
in  any  of  the  EULAs  reviewed.  One  EULA  contained  desired  language  for  automatic 
renewals  and  another  for  governing  law.  For  example,  one  EULA  stated  "Licensee 
(DON  in  this  case)  shall  be  notified  of  renewal  options  in  advance  of  renewal  periods." 
The  inclusion  of  this  statement  in  the  EULA  allows  the  DON  to  make  a  determination 
whether  to  renew  the  software  product  at  the  end  of  the  contract  period,  as  opposed  to 
automatically  renewing. 


Clauses  Specific  to  Software  License  Acquisitions  Were 
Not  Required 


The  Assistant  Secretary  of  the  Navy  (Research  Development  and  Acquisitions) 
(ASN  [RDA])  did  not  develop  or  issue  guidance  on  whether  to  include  specific 
clauses  in  software  license  contracts;  therefore,  DON  contracts  did  not  include  the 
appropriate  best  practice  language.  The  Under  Secretary 


of  the  Navy  issued  a  memorandum  tasking  the  DON 
to  use  DoD  IT  consolidation  efforts.  In  addition, 
ASN  (RDA)  and  DON  CIO  issued  a  memorandum 
tasking  the  DON  to  use  DON  ELAs  to  achieve 
maximum  cost  savings.  However,  the  ASN  (RDA) 
lacked  guidance  that  included  specific  clauses 
or  required  Navy  organizations  to  make  a 
determination  on  clauses  contracting  officers 
should  ensure  are  included  in  software  license 
contracts.  The  DFARS  includes  subparts  that 


The 

ASN  (RDA) 
lacked  guidance 
that  included  specific 
clauses  or  required  Navy 
organizations  to  make  a 
determination  on  clauses 
contracting  officers  should 
ensure  are  included  in 
software  license 
contracts. 
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address  rights  regarding  computer  software,  computer  software  documentation, 
enterprise  software  agreements,  and  acquisition  procedures.  However,  the  DFARS 
subparts  prescribe  policy  and  procedures  for  acquiring  commercial  software  and 
do  not  include  desired,  unacceptable,  or  recommended  language  for  use  in  software 
license  contracts.  In  addition,  DFARS  Subpart  208.7402  instructs  DoD  departments 
and  agencies  to  fulfill  requirements  for  commercial  software  in  accordance  with  the 
DoD  ESI.  The  ESI,  however,  states  only  that  the  Software  Buyers  Checklist  is  a  starting 
point  and  does  not  state  that  departments  and  agencies  must  follow  it. 

Contracting  Officers  Did  Not  Receive  and  Were  Often 
Unaware  of  Specific  Training  for  Writing  Software 
License  Contracts 

The  contracts  also  did  not  include  the  appropriate  best  practice  language  because 
contracting  officers  did  not  receive  the  necessary  training  to  gain  the  specialized 
knowledge  to  write  software  license  contracts  properly.  Specifically,  11  of  the 
13  contracting  officers  stated  that  they  had  not  received  specific  training  for  acquiring 
software  licenses.  One  contracting  officer  who  had  received  training  stated  that  he  had 
ESI  training  a  few  years  ago  while  working  for  the  Army  but  had  not  taken  any  other 
specific  training  for  acquiring  software  licenses.  The  other  contracting  officer  stated  that 
someone  in  their  office  who  used  ESI  extensively  provided  them  with  informal  training 
but  that  she  had  not  taken  any  other  training.  The  ASN  (RDA)  should  develop  a  plan  of 
action  and  milestones  in  conjunction  with  the  DON  CIO,  to  ensure  that  contracting  officers 
take  software  licensing  training  before  issuing  any  future  software  license  contracts. 

Software  licensing  training  that  included  best  practice  language  was  available  for 
contracting  officers;  however,  ASN  (RDA)  did  not  require  contracting  officials  to  take  the 
training.  The  Army  CHESS  website  includes  briefing  slides  with  the  "ABCs  of  Software." 
According  to  CHESS  officials,  the  goal  is  to  provide  website  videos  and  tutorials  in  the 
future.  In  addition,  CHESS  officials  stated  that  DoD  ESI  is  supplementing  CHESS  by  offering 
a  2-day  commercial  software  training  with  a  chapter  on  EULAs.  However,  ASN  (RDA) 
did  not  require  contracting  personnel  to  view  the  briefings  or  take  the  available  training. 
According  to  DON  CIO  personnel,  they  were  not  in  a  position  to  mandate  this  training 
to  DON  contracting  personnel,  as  policies  and  guidance  for  the  acquisition  workforce 
are  under  the  authority  of  the  Chief  Acquisition  Officer.  However,  DON  CIO  personnel 
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stated  that  planning  was  underway  to  offer  training  in  FY  2013.  During  a  meeting  with 
ASN  (RDA)  and  DON  CIO  personnel,  they  agreed  that  development  of  any  guidance 
involving  contracting  and  software  related  topics  is  a  joint  effort  between  the  two  offices. 


In  many  cases,  DON  contracting  officers  were  not  aware  training  was  available. 
Specifically,  8  of  the  13  contracting  officers  stated  that  they  were  not  aware  of  the 
DoD  ESI  training  or  any  other  training  specific  to  acquiring  software 
license  agreements.  When  asked  whether  they  made 
contracting  personnel  involved  with  acquisition  of 


software  licenses  aware  of  the  available  training, 

DON  CIO  personnel  stated  that  they  mentioned 
the  availability  of  the  ESI  training  during  the  DON 
Information  Management/IT  conference  held  in 
San  Diego,  California,  and  Virginia  Beach,  Virginia, 
during  a  "software  licensing  themed”  training 
session.  In  addition,  they  stated  that  the  software 
licensing  training  content  was  provided  to  each  student 
on  CD  if  they  took  the  Defense  Acquisition  University  Software 
Acquisition  Management  301  class. 


Specifica 
8  of  the 
contracting  c 
stated  that  they  were 
not  aware  of  the  DoD  ESI 
training  or  any  other 
training  specific  to 
acquiring  software 
license  agreements. 


Trainings  were  in  place  to  address  the  acquisition  of  software  licenses;  however,  the 
trainings  were  ineffective  if  contracting  officers  were  not  required  to  take  the  training  or 
the  DON  CIO  did  not  make  them  aware  that  the  training  was  available.  DON  contracting 
officers  were  made  aware  of  the  available  trainings  only  if  they  attended  one  of  the  DON 
conferences  or  took  the  Defense  Acquisition  University  class.  The  DON  CIO’s  Director 
of  Enterprise  Commercial  Information  Technology  Strategy  stated  that  in  anticipation  of 
potential  recommendations  from  our  report,  he  authorized  the  posting  of  the  DoD  ESI 
approved  software  licensing  training  to  the  DoD  ESI  webpage  in  March  2013.  We  verified 
that  "Software  Licensing  Training:  Acquiring  Licenses  in  These  Changing  Times"  was 
available  as  of  March  2013.  The  DON  CIO  should  develop  and  issue  a  memo  identifying  the 
types  of  training  available  to  contracting  officers  who  prepare  software  license  contracts; 
this  would  allow  contracting  officers  to  determine  the  appropriate  language  needed  in 
the  contracts,  as  well  as  provide  guidance  as  to  acceptable  and  unacceptable  language 
required  in  EULAs.  Likewise,  the  ASN(RDA)  should  require  all  DON  contracting  officers 
who  prepare  software  license  contracts  and  review  EULAs,  as  well  as  contracting  personnel 
that  review  software  license  or  software  acquisitions  contracts  prior  to  issuance,  to  take 
specialized  training  on  using  appropriate  language  in  software  acquisition  contracts. 
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Increased  Risk  of  Wasteful  Spending, 
Government  Disruption,  Software  Vendor  Claims 
and  Other  Related  Disputes 


The  DON  increases  the  risk  of  wasteful  spending,  disrupts 
to  Government  operations,  and  vulnerability  to  lawsuits, 
claims,  and  penalties  if  it  does  not  include  appropriate 
language  in  software  license  contracts  that  is,  geared 
to  protect  the  best  interests  of  the  DON.  For  example, 
when  a  contract  includes  unacceptable  language, 
such  as  the  contract  that  contained  a  90-day 
warranty  instead  of  1  year  from  the  first  use  of  the 
product,  the  vendor  has  no  obligation  to  fix  software  that 


malfunctions  after  90  days.  This  lack  of  a  proper  warranty 

clause  could  lead  to  the  disruption  of  Government  operations  or  the  need  to  purchase 
other  software  or  software  services  to  improve  or  continue  operations.  In  addition  to 
warranties,  the  inclusion  of  unacceptable  language  or  silence  in  areas  such  as  transfer 
rights,  termination  rights,  and  audit  rights  could  result  in  wasteful  spending  of  funds  as 
well  as  disruption  to  Government  operations.  For  example,  the  contracts  that  were  silent 
on  transfer  rights  or  that  allowed  transfer  only  within  the  program  that  purchased  it, 
could  have  unused  licenses  that  could  fill  the  needs  of  another  DON  program.  However, 
because  the  contracts  are  silent  and  the  EULA  does  not  allow  for  transfer  to  other 
programs,  DON  could  be  forced  to  purchase  additional  licenses  to  meet  the  needs  of 
another  program  instead  of  using  licenses  already  owned. 

In  addition,  when  a  contracting  officer  accepts  audit  terms  that  allow  a  vendor  to  inspect 
a  DoD  facility  and  records  to  verify  compliance,  they  risk  exposing  DoD  information  and 
incurring  more  costs  if  DoD  must  pay  for  the  audit.  Further,  when  vendors  are  allowed  to 
establish  licensing  agreements  directly  with  individual  end  users  rather  than  negotiating 
an  overall  software  licensing  agreement  with  the  contracting  officer,  the  risk  increases 
that  software  will  be  misused  or  improper  licensing  terms  will  be  accepted.  This  can 
result  in  vendor  claims  or  disputes  with  DoD  in  the  future. 
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Management  Comments  on  the  Finding  and 
Our  Response 

Management  Comments  on  Cost-Saving  Efficiencies 

The  DON  CIO  submitted  general  comments,  stating  that  the  DON  CIO  identified 
Enterprise  Software  Licensing  as  a  primary  DON  efficiency  target  to  achieve 
cost-savings.  He  stated  that  through  policy  and  Integrated  Product  Team  actions,  the 
efficiency  initiative  has  realized  significant  progress  contributing  over  $73  million  in 
current  and  projected  savings  using  the  two  Department-wide  ELAs  awarded  to  date. 
He  further  stated  that  as  DON  continues  to  establish  ELAs,  they  are  implementing 
lessons  learned  and  management  best  practices  including  those  identified  in  our 
recommendations. 

Our  Response 

We  commend  the  DON  CIO  on  the  efforts  taken  to  lower  prices  and  increase  savings 
within  the  DON. 

Recommendations,  Management  Comments,  and 
Our  Responses 

Recommendation  1 

We  recommend  that  the  Assistant  Secretary  of  the  Navy  (Research,  Development 
and  Acquisition): 

a.  Require  all  Navy  contracting  personnel  involved  in  preparing  and 
issuing  software  license  contracts  to  take  specialized  training  that 
ensures  software  license  contracts  include  only  appropriate  language 
that  protects  the  best  interest  of  the  Government. 

Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition  and 
Procurement  Comments 

The  Executive  Director  for  the  Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition 
and  Procurement  (DASN  [AP])  responded  for  the  ASN  (RDA)  and  agreed,  stating  that  the 
DASN  (AP)  will  issue  a  memorandum  requiring  Navy  contracting  personnel  involved  in 
preparing  and  awarding  software  license  contracts  to  take  specialized  training  that  ensure 
software  license  contracts  include  appropriate  language  to  protect  the  best  interest  of  the 
Government.  The  Executive  Director  further  stated  that  DASN  (AP)  would  complete  the 
memorandum  for  issuance  within  30  days  after  DON  CIO  identifies  the  available  training 
in  accordance  with  recommendation  2.c. 
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Our  Response 

The  Executive  Director’s  comments  were  responsive,  and  no  additional  comments 
are  required. 

b.  Develop  a  plan  of  action  and  milestones  in  conjunction  with  the 
Department  of  the  Navy  Chief  Information  Officer  to  ensure  that 
contracting  officers  take  software  licensing  training  before  issuing  any 
future  software  license  contracts. 

Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition  and 
Procurement  Comments 

The  Executive  Director  responded  for  ASN  (RDA)  and  agreed  stating  that  DASN(AP)  will 
coordinate  with  the  DON  CIO  to  develop  a  plan  of  action  and  milestones  to  ensure  that 
applicable  contracting  personnel  take  software  licensing  training  prior  to  issuing  any 
future  software  license  contracts.  The  Executive  Director  stated  that  DASN(AP)  would 
also  complete  the  plan  of  actions  and  milestones  within  30  days  after  DON  CIO  identifies 
the  dates  and  types  of  available  training  as  recommended  in  recommendation  2.c. 

Our  Response 

The  Executive  Director’s  comments  were  responsive,  and  no  additional  comments 
are  required. 

Recommendation  2 

We  recommend  that  the  Department  of  the  Navy  Chief  Information  Officer: 

a.  Determine  whether  it  is  in  the  Government’s  interest  to  modify  the 
Microsoft  enterprise  license  agreement’s  language  regarding  warranty 
and  embedded  third-party  software  and  take  appropriate  action. 

Department  of  the  Navy  Chief  Information  Officer  Comments 

The  Chief  Information  Officer  agreed,  stating  that  the  DON  CIO,  in  collaboration  with  the 
ASN  (RDA),  will  review  the  DON  Microsoft  ELA,  which  is  currently  in  its  second  option 
year  of  a  three-option-year  agreement,  regarding  the  warranty  and  embedded  third-party 
software  to  assess  impact  and  risk  of  incorporating  this  language  at  this  point  in  the 
implementation  of  the  current  ELA.  The  Chief  Information  Officer  further  explained  that 
in  conducting  the  review,  the  DON  will  benchmark  its  DON  Microsoft  ELA  with  other 
DoD  and  Federal  Agency  Microsoft  enterprise  licenses  that  are  available  for  review,  as 
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well  as  with  DoD  ESI  Blanket  Purchase  Agreements  and  any  related  Federal  Acquisition 
Regulation  and  General  Services  Administration  Schedule  70  provisions.  Following  the 
review,  the  DON  will  take  appropriate  action. 

Our  Response 

The  Chief  Information  Officer’s  comments  were  responsive,  and  no  additional  comments 
are  required. 

b.  Require  individuals  to  include  the  same  or  similar  language,  related  to 
warranty  and  embedded  third-party  software,  provided  in  the  software 
license  training,  when  preparing  enterprise  license  agreements  for 
the  remaining  software  opportunities  identified  in  the  February  2012 
memorandum,  "Mandatory  Use  of  Department  of  the  Navy  Enterprise 
Licensing  Agreements,"  or  require  the  individuals  to  document  how 
and  why  they  determined  and  accepted  the  risk  of  not  including  the 
recommended  language. 

Department  of  the  Navy  Chief  Information  Officer  Comments 

The  Chief  Information  Officer  agreed  stating  that  through  collaboration  between 
ASN-(RDA)  and  DON  CIO,  the  DON  plans  to  incorporate  best  practices,  terms,  and 
conditions  into  future  DON  ELAs  and  is  building  and  expanding  on  its  commercial 
software  licensing  expertise  through  its  multi-organizational  and  multifunctional 
DON  Enterprise  Software  Licensing  team.  The  Chief  Information  Officer  further  stated 
that  the  DON  is  participating  in  DoD-level  enterprise  software  license  projects  through 
ESI  that  have  a  focus  on  EULAs  and  commercial  software  licensing  best  practices.  Finally, 
he  stated  that  in  any  DON  ELAs  they  will  specifically  address  warranty  and  embedded 
third-party  software  terms  and  conditions  in  documentation  that  provides  rationale  if  a 
determination  was  made  not  to  include  the  provisions. 

Our  Response 

The  Chief  Information  Officer’s  comments  were  responsive,  and  no  additional  comments 
are  required. 

c.  Develop  and  issue  a  memorandum  identifying  the  types  of  training — 
providing  knowledge  to  determine  the  appropriate  language  needed 
in  the  contracts  and  acceptable  and  unacceptable  language  required 
in  End  User  License  Agreements — available  to  contracting  officers  who 
prepare  software  license  contracts. 
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Department  of  the  Navy  Chief  Information  Officer  Comments 

The  Chief  Information  Officer  agreed,  stating  that  the  DON  CIO,  in  collaboration  with 
ASN  (RDA),  will  consult  with  the  Defense  Acquisition  University  to  explore  enhancing 
software  licensing  content  of  appropriate  course  offerings.  The  Chief  Information  Officer 
further  stated  that  the  DON  CIO  will  continue  to  offer  training  sessions  on  topics  related 
to  EULAs  and  make  related  training  content  available  via  the  DON  CIO  and  DoD  ESI 
websites.  Finally,  he  stated  that  the  DON  will  conduct  market  research  on  available 
training  on  commercial  software  licensing  and  communicate  availability  to  ASN  (RDA) 
and  apply  appropriate  methods  to  achieve  the  broadcast  awareness  by  DON  contracting 
and  IT  professionals. 

Our  Response 

The  Chief  Information  Officer’s  comments  were  partially  responsive.  Although  the  Chief 
Information  Officer  plans  to  collaborate  with  ASN  (RDA)  to  make  efforts  toward  enhancing 
training  content  and  will  communicate  availability  of  trainings  to  DON  contracting  and 
IT  professionals  as  well  as  ASN  (RDA),  he  did  not  include  any  timelines  to  achieve  this 
broadcast  awareness.  Because  the  timeframe  that  DASN  (AP),  under  the  authority 
of  ASN  (RDA),  agreed  to  issue  a  memorandum  requiring  Navy  contracting  personnel 
involved  in  preparing  and  issuing  software  license  contracts  to  take  specialized  training 
in  Recommendation  l.a.  is  based  on  DON  CIO  identifying  the  available  trainings,  it  is 
critical  that  the  DON  CIO  sets  a  reasonable  timeline  for  completing  this  task.  We  request 
that  the  Chief  Information  Officer  provide  additional  comments  in  response  to  the  final 
report  that  include  a  timeline  for  completing  the  noted  tasks  and  providing  awareness 
of  these  opportunities  to  DON  contracting  and  IT  professionals. 
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Scope  and  Methodology 

We  conducted  this  performance  audit  from  July  2012  through  May  2013  in  accordance 
with  generally  accepted  Government  auditing  standards.  These  standards  require  that 
we  plan  and  perform  the  audit  to  obtain  sufficient,  appropriate  evidence  to  provide  a 
reasonable  basis  for  our  findings  and  conclusions  based  on  our  audit  objective.  We  believe 
that  the  evidence  obtained  provides  a  reasonable  basis  for  our  findings  and  conclusions 
based  on  our  audit  objective. 

We  conducted  this  audit  to  determine  if  the  DON  included  appropriate  clauses  in  software 
procurement  contracts.  We  focused  our  audit  on  commercial  off-the-shelf  software 
contracts  issued  by  the  DON  in  order  to  review  the  contract  writing  practices  of  DON 
contracting  offices.  We  selected  a  nonstatistical  sample  of  Navy  contracts  active  in 
FY  2012:  1  ELA  contract  and  13  non-ELA  contracts.  We  received  assistance  from  the 
Quantitative  Methods  Division  in  selecting  this  nonstatistical  sample. 

We  conducted  our  review  using  the  most  current  version  of  the  Army  CHESS  training, 
which  DoD  ESI  modified  and  Army  CHESS  issued  in  September  2012  under  the  name, 
"Software  that  Goes  Bump  in  the  Night  Brief."  Based  on  the  DoD  ESI  and  CHESS  level 
of  expertise,  we  considered  the  best  practices  listed  in  the  "Software  that  Goes  Bump  in 
the  Night  Brief"  training  to  be  reasonable.  We  did  not  perform  any  tests  to  determine  if 
the  best  practices  were  sufficient  to  protect  the  Government’s  best  interest  fully  when 
acquiring  software  licenses. 

The  "Software  that  Goes  Bump  in  the  Night  Brief"  training  presents  the  top  11  most 
occurring  areas  of  concern  regarding  the  acquisition  of  software  licenses.  It  discusses  the 
suggested  DoD  ESI’s  Buyer  Checklist  requirement  for  each  of  the  11  areas  and  includes 
examples  of  acceptable  and  unacceptable  language  to  look  for  in  contracts  and  EULAs  for 
each  area.  For  each  contract,  we  reviewed  the  base  contract  and  the  EULA  (or  equivalent 
document)  provided  by  the  contracting  officer,  to  ensure  the  contract  files  included  the 
desirable  language  and  excluded  unacceptable  language  in  accordance  with  each  of  these 
11  areas  of  concern.  Specifically,  for  all  identified  language  applicable  to  the  11  areas  of 
concern,  the  audit  team  would  refer  back  to  the  "Software  that  Goes  Bump  in  the  Night 
Brief"  training  to  verify  whether  the  included  language  was  desirable,  acceptable,  or 
unacceptable.  When  we  found  a  contract  that  was  silent  in  any  of  the  11  areas,  we  would 
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assess  whether  it  was  acceptable  or  unacceptable  for  that  area  to  be  silent  by  determining 
whether  it  was  in  the  Government’s  best  interest  to  address  the  areas  in  the  contract  based 
on  the  stated  best  practice  for  that  specific  topic.  We  made  the  following  determinations: 

•  Desirable:  Contract  documents  that  included  the  desirable  language  per 
the  examples  provided  in  the  "Software  that  Goes  Bump  in  the  Night  Brief" 
training  for  the  11  reviewed  areas  of  concern. 

•  Acceptable:  Contract  documents  that  were  silent  (no  language  included)  to 
the  areas  of  concern:  Third-party  software  (embedded),  audit  rights,  click 
wrap  license,  automatic  renewals,  governing  law,  installation  restrictions, 
and  virtualization.  When  a  contract  did  not  include  unacceptable  language 
for  these  specific  areas  of  concern,  we  determined  that  the  Government  was 
not  required  to  perform  under  those  unacceptable  terms.  Therefore,  because 
the  contract  documents  were  completely  silent  to  these  specific  areas,  they 
were  acceptable. 

•  Unacceptable:  Contract  documents  that  were  silent  (no  language  included) 
to  the  areas  of  concern:  Warranty,  transfer  rights,  termination  rights,  and  order 
of  precedence  (acceptable  for  EULA  to  be  silent).  Also  in  this  category  are  the 
contract  documents  that  included  unacceptable  language  per  the  examples 
provided  in  the  "Software  that  Goes  Bump  in  the  Night  Brief"  training  for  the 
11  reviewed  areas  of  concern. 

Use  of  Computer-Processed  Data 

We  did  not  use  computer-processed  data  to  perform  this  audit. 

Use  of  Technical  Assistance 

We  obtained  support  from  the  DoD  Office  of  Inspector  General  Quantitative  Methods 
Division  on  sampling  methodology.  Considering  the  lack  of  a  Navy  Software  Licensing 
Contracts’  database,  Quantitative  Methods  Division  assisted  the  audit  team  in  formulating 
the  steps  necessary  to  select  a  nonstatistical  sample  for  review. 

Prior  Coverage 

No  prior  coverage  has  been  conducted  on  the  Navy,  including  appropriate  clauses  in 
software  procurement  contracts,  during  the  last  5  years. 
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Management  Comments 

Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition 
and  Procurement 


DEPARTMENT  OF  THE  NAVY 
OFFICE  OF  THE  ASSISTANT  SECRETARY 
RESEARCH,  DEVELOPMENT  AND  ACQUISITION 
1000  NAVY  PENTAGON 
WASHINGTON  DC  20350-1000 


MEMORANDUM  FOR  PROGRAM  DIRECTOR,  READINESS  AND 
FIBER  OPERATIONS 

SUBJECT:  The  Navy’s  Management  of  Software  Licenses  Needs  Improvement  (Project 
No.  D20 1 2-D000LB-0 1 77.000) 

The  attached  document  provides  our  response  to  Recommendation  1  of  the  subject 
audit  report.  We  do  not  consider  any  matters  discussed  in  the  report  to  be  exempt  from 
public  release.  My  point  of  contact  for  this  action  is  .  He  can  be 


reached  at 


RDMbrSerUSN' 
Executive  Director 
DASN  (AP) 


Attachment: 
As  slated 
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Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition 
and  Procurement  (cont'd) 


DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL  REPORT 
PROJECT  NO.  D20 1 2-D000LB-0 1 77 .000  DATED  7  JUNE  2013 

‘THE  NAVY'S  MANAGEMENT  OF  SOFTWARE  LICENSES 
NEEDS  IMPROVEMENT' 

RECOMMENDATION  la. :  The  Department  of  Defense  Inspector  General  (DoDIG) 
recommended  that  the  Assistant  Secretary  of  the  Navy  (Research.  Development  and 
Acquisition)  require  all  Navy  contracting  personnel  involved  in  preparing  and  issuing 
software  license  contracts  to  take  specialized  training  that  ensures  software  license 
contracts  only  include  appropriate  language  that  protects  the  best  interest  of  the 
Government. 

RESPONSE:  Concur.  The  Deputy  Assistant  Secretary  of  the  Navy  for  Acquisition  and 
Procurement  (DASN(AP))  w  ill  issue  a  memorandum  to  Department  of  the  Navy 
contracting  activities  requiring  all  Navy  contracting  personnel  involved  in  preparing  and 
awarding  software  license  contracts  to  take  specialized  training  to  ensure  that  software 
license  contracts  include  appropriate  language  that  protects  the  best  interest  of  the 
Government. 

Target  completion  for  issuance  of  the  memorandum:  Within  30  days  after  the 
Department  of  the  Navy  Chief  Information  Officer  identifies  the  training  available  to 
contracting  personnel  who  prepare  or  award  software  license  contracts. 

RECOMMENDATION  lb.  :  The  DoDIG  recommended  that  the  Assistant  Secretary 
of  the  Navy  (Research.  Development  and  Acquisition)  develop  a  plan  of  action  and 
milestones  in  conjunction  with  the  Department  of  the  Navy  Chief  Information  Officer  to 
ensure  that  contracting  officers  take  software  licensing  training  before  issuing  any  future 
software  license  contracts. 

RESPONSE:  Concur.  DASN(AP)  will  coordinate  with  the  Department  of  the  Navy 
Chief  Information  Officer  to  develop  a  plan  of  action  and  milestones  to  ensure  that 
applicable  contracting  personnel  take  software  licensing  training  before  issuing  any 
future  software  license  contracts. 

Target  completion  for  issuance  of  the  plan  of  action  and  milestones:  Within  30  days  after 
the  Department  of  the  Navy  Chief  Information  Officer  identifies  the  dates  and  types  of 
training  available  to  contracting  personnel  who  prepare  or  award  software  license 
contracts. 
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Department  of  the  Navy  Chief  Information  Officer 


DEPARTMENT  OF  THE  NAVY 

CHIEF  INFORMATION  OFFICER 
1000  NAVY  PENTAGON 
WASHINGTON  DC  20350-1000 


9  July  2013 


MEMORANDUM  FOR  DEPARTMENT  OF  DEFENSE  INSPECTOR  GENERAL  (DOD  IG) 

Subj:  RECOMMENDATIONS  FOR  THE  DEPARTMENT  OF  THE  NAVY  CHIEF 

INFORMATION  OFFICE  IN  THE  DEPARTMENT  OF  DEFENSE  INSPECTOR 
GENERAL  DRAFT  REPORT  ENTITLED  "NAVY  SOFTWARE  LICENSE 
MANAGEMENT  NEEDS  IMPROVEMENT"  (PROJECT  NO.  D2012-D000LB- 
0177.000) 

Enel:  (1)  DON  CIO  Response  to  Recommendations  Presented  in  the  DoD  IG  Draft  Report: 

"Navy  Software  License  Management  Needs  Improvement"  (Project  No.  D2012- 
DOOOLB-0 177.000) 

This  memorandum  forwards  the  Department  of  the  Navy  Chief  Information  Officer 
(DON  CIO)  response  to  recommendations  2a,  2b,  and  2c,  presented  in  the  June  7,  2013 
Department  of  Defense  Inspector  General  (DoD  IG)  draft  report  entitled  "Navy  Software  License 
Management  Needs  Improvement"  (see  enclosure  (1)). 

The  DON  CIO  point  of  contact  for  this  audit  is  who  can  be  reached 


at 


T e$y  A.Tialvorsen 
Department  of  the  Navy 
Chief  Information  Officer 


Copy  to: 

ASN  (RD&A) 
NAVINSGEN 
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Department  of  the  Navy  Chief  Information  Officer 
(cont'd) 


Department  of  the  Navy  Chief  Information  Officer  (DON  CIO)  Response  to 
Recommendations  Presented  in  DoD  IG  Draft  Report,  D2012-D000LB-0177.000, 

Navy  Software  License  Management  Needs  Improvement 

General  Comment:  As  the  SECNAV-appointed  lead  for  DON  cost-saving  Information 
Technology  (IT)  efficiencies,  the  DON  CIO  identified  Enterprise  Software  Licensing  (ESL)  as  a 
primary  DON  efficiency  target.  Through  policy  and  Integrated  Product  Team  actions,  this 
efficiency  initiative  has  realized  significant  progress  in  achieving  cost  savings  and  management 
efficiencies  through  enterprise  licensing.  To  date,  the  DON  has  awarded  two  Department-wide 
enterprise  license  agreements  (ELAs)  contributing  over  $73  million  in  current  and  projected 
savings  toward  the  DON  savings  goal  for  enterprise  software  licensing  across  the  FYDP.  As  the 
DON  continues  to  establish  ELAs,  we  are  refining  our  demand  management  processes  and 
implementing  lessons  learned,  which  will  result  in  lower  prices,  increased  savings  and  improved 
management  best  practices,  including  those  discussed  below. 

Recommendation  2.a.:  Determine  whether  it  is  in  the  Government's  interest  to  modify  the 
Microsoft  enterprise  license  agreement's  language  regarding  warranty  and  embedded  third-party 
software  and  take  appropriate  action. 

Response:  Concur.  The  DON  Microsoft  ELA  is  currently  in  its  second  option  year  of  a  three 
option  year  agreement.  The  DON  CIO,  in  collaboration  with  the  Assistant  Secretary  of  the  Navy 
(Research,  Development  and  Acquisition)  (ASN  RDA),  will  review  the  DON  Microsoft  Enterprise 
License  Agreement  (ELA)  regarding  the  warranty  and  embedded  third-party  software  to  assess 
impact  and  risk  of  incorporating  this  language  at  this  point  in  the  implementation  of  the  current 
ELA.  In  conducting  this  review,  the  DON  will  benchmark  its  DON  Microsoft  ELA  with  other 
Department  of  Defense  (DoD)  and  Federal  Agency  Microsoft  enterprise  licenses  that  are  available 
for  review,  as  well  as  with  DoD  Enterprise  Software  Initiative  (ESI)  Blanket  Purchase  Agreements 
and  any  related  Federal  Acquisition  Regulation  and  General  Services  Administration  Schedule  70 
provisions.  Following  this  review,  the  DON  will  take  appropriate  action. 

Recommendation  2.b.:  Require  individuals  to  include  the  same  or  similar  language,  related  to 
warranty  and  embedded  third-party  software,  provided  in  the  software  license  training,  when 
preparing  enterprise  license  agreements  for  the  remaining  software  opportunities  identified  in  the 
February  2012  memorandum,  "Mandatory  Use  of  Department  of  the  Navy  Enterprise  Licensing 
Agreements,"  or  require  the  individuals  to  document  how  and  why  they  determined  and  accepted 
the  risk  of  not  including  the  recommended  language. 

Response:  Concur.  Through  collaboration  between  ASN  RDA  and  DON  CIO,  the  DON  plans  to 
incorporate  best  practices,  terms,  and  conditions  into  future  DON  ELAs.  The  DON  is  building 
and  expanding  on  its  commercial  software  licensing  expertise  through  its  multi-organizational 
and  multi-functional  DON  ESL  team.  The  DON  is  also  participating  in  DoD  level  enterprise 
software  licensing  projects  through  the  DoD  ESI,  where  End  User  License  Agreements  (EULAs) 
and  commercial  software  licensing  best  practices  are  an  important  focus.  For  example,  the  DoD 
ESI  provides  sample  terms  and  conditions  for  use  in  EULAs  and  a  Software  Buyers'  Checklist 
that  prompts  the  buyer  to  consider  specific  licensing  terms  and  conditions  as  part  of  the  buy.  The 
warranty  and  embedded  third-party  software  terms  and  conditions  will  be  specifically  addressed 
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in  documentation  with  rationale  if  a  determination  was  made  that  the  provisions  will  not  be 
included  in  any  DON  ELA. 

Recommendation  2.c.:  Develop  and  issue  a  memorandum  identifying  the  types  of  training  - 
providing  knowledge  to  determine  the  appropriate  language  needed  in  the  contracts  and 
acceptable  and  unacceptable  language  required  in  End  User  License  Agreements  available  to 
contracting  officers  who  prepare  software  license  contracts. 

Response:  Concur.  A  workforce  that  is  trained  and  experienced  in  commercial  software 
licensing  is  important  for  effective  enterprise  license  agreements  and  sustained  savings.  To  this 
end,  the  DON  CIO,  in  collaboration  with  ASN  RDA,  will  consult  with  the  Defense  Acquisition 
University  to  explore  enhancing  software  licensing  content  of  appropriate  course  offerings.  The 
DON  CIO  will  continue  to  offer  training  sessions  on  topics  related  to  EULAs  and  make  related 
training  content  available  via  the  DON  CIO  and  DoD  ESI  web  sites.  Additionally,  the  DON  will 
conduct  market  research  on  available  training  on  commercial  software  licensing  and  will 
communicate  availability  to  ASN  RDA  for  use  as  needed  and  will  apply  appropriate  methods  to 
achieve  the  broadest  awareness  and  participation  by  DON  contracting  and  IT  professionals. 
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Acronyms  and  Abbreviations 


ASN  (RDA) 
CIO 
CHESS 
DASN  (AP) 
DFARS 
DON 
ELA 
ESI 
EULA 
FAR 
IT 


Assistant  Secretary  of  the  Navy  (Research,  Development,  and  Acquisition) 
Chief  Information  Officer 

Computer  Hardware  Enterprise  Software  and  Solutions 

Deputy  Assistant  Secretary  of  the  Navy  (Acquisition  and  Procurement) 

Defense  Federal  Acquisition  Regulation  Supplement 

Department  of  the  Navy 

Enterprise  Licensing  Agreement 

Enterprise  Software  Initiative 

End  User  License  Agreement 

Federal  Acquisition  Regulation 

Information  Technology 
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The  Whistleblower  Protection  Enhancement  Act  of  2012  requires 
the  Inspector  General  to  designate  a  Whistleblower  Protection 
Ombudsman  to  educate  agency  employees  about  prohibitions  on 
retaliation,  and  rights  and  remedies  against  retaliation  for  protected 
disclosures.  The  designated  ombudsman  is  the  DoD  IG  Director  for 
Whistleblowing  &  Transparency.  For  more  information  on  your  rights 
and  remedies  against  retaliation,  go  to  the  Whistleblower  webpage  at 
www.dodig.mil/programs/whistleblower. 


For  more  information  about  DoD  IG 
reports  or  activities,  please  contact  us: 

Congressional  Liaison 

Congressional@dodig.mil;  703.604.8324 

DoD  Hotline 

800.424.9098 

Media  Contact 

Public.Affairs@dodig.mil;  703.604.8324 

Monthly  Update 

dodigconnect-request@listserve.com 

Reports  Mailing  List 

dodig_report-request@listserve.com 

Twitter 

twitter.com/DoD_IG 


